Internet Noise & Scanner Traffic Lookup
Investigate internet background radiation, classify benign vs. malicious IP scanners, and generate SIEM false-positive filters.
71.6.232.4
census4.shodan.ioActor: Shodan.io (Commercial Internet Crawling Engine)
Scanner Metadata & Network Attribution
Observed Scanning Behaviors & Tags
Frequently Targeted Ports
Correlated CVE Exploits
SOC False-Positive Suppression Rules
Use these ready-to-deploy query rules in your SIEM or perimeter firewall to filter out benign scanner traffic and reduce SOC alert fatigue.
index=firewall NOT src_ip="71.6.232.4" | stats count by dest_port, action
not source.ip: "71.6.232.4" and event.outcome: "denied"
pass ip 71.6.232.4 any -> $HOME_NET any (msg:"Whitelisted Shodan Benign Scanner"; sid:9000101; rev:1;)
iptables -I INPUT -s 71.6.232.4 -j ACCEPT -m comment --comment "Whitelist Benign Shodan Scanner"
Live Global Internet Radiation Feed
Simulated real-time packet capture of indiscriminate mass scanner probes arriving at global honeypot sensors.
| Timestamp | Source IP | Classification | Actor / Entity | Target Port | Observed Payload / Tag |
|---|---|---|---|---|---|
| 11:24:02 UTC | 71.6.232.4 |
Benign | Shodan.io Crawler | 443 (HTTPS) | TLS Handshake Probe |
| 11:23:58 UTC | 194.26.29.112 |
Malicious | Mirai Botnet Variant | 23 (Telnet) | admin:admin brute-force |
| 11:23:45 UTC | 162.142.125.10 |
Benign | Censys Research | 80 (HTTP) | GET / HTTP/1.1 survey |
| 11:23:30 UTC | 185.220.101.5 |
Suspicious | Tor Exit Relay | 22 (SSH) | Dictionary root login |
| 11:23:12 UTC | 89.248.165.77 |
Malicious | Known CVE Exploiter | 8080 (HTTP) | ${jndi:ldap://...} Log4j attempt |
About this tool
How to use it
- Enter an IPv4 address into the threat lookup bar or select a sample scanner IP.
- Inspect the noise classification: determine if traffic is Benign Research, Malicious Botnet, or Unknown Scanner.
- Review targeted ports, observed CVE exploit payloads (e.g., Log4j, Mirai), and ASN actor metadata.
- Export SOC whitelist rules for Splunk, Elastic SIEM, Suricata, or IPTables to eliminate false-positive alert fatigue.
Why it matters
Security Operations Centers (SOCs) waste thousands of analyst hours triaging alerts triggered by ubiquitous background internet scanning from universities, search engines, and commercial threat intelligence firms. This tool differentiates benign noise from targeted exploitation, allowing defenders to focus on real security threats.
When to use it
Use when investigating firewall intrusion alerts, triaging SIEM alerts, auditing inbound IP reputation, creating SOC alert suppression rules, or studying global internet background radiation.
Common questions
What is Internet Background Noise?
Internet Background Noise consists of packets and scans continuously traversing the public internet aimed at all IPv4 addresses indiscriminately. It is generated by research organizations (like Shadowserver and Censys) as well as automated botnet worms (like Mirai).
How does the tool classify Benign vs. Malicious actors?
Actors are evaluated based on known research ASN registrations, published opt-out contacts, scan intent (reconnaissance vs. payload delivery), and historical telemetry stored in the client-side threat intelligence engine.
Can I export SIEM rules from this tool?
Yes. The SIEM Rule Generator outputs formatted query filters for Splunk SPL, Elasticsearch KQL, Suricata signatures, and IPTables drop rules with one-click clipboard copying.